/*     */ package com.zimbra.qa.unittest.prov.ldap;
/*     */ 
/*     */ import com.zimbra.common.service.ServiceException;
/*     */ import com.zimbra.common.util.SetUtil;
/*     */ import com.zimbra.cs.account.Account;
/*     */ import com.zimbra.cs.account.AttributeClass;
/*     */ import com.zimbra.cs.account.AttributeManager;
/*     */ import com.zimbra.cs.account.Domain;
/*     */ import com.zimbra.cs.account.Entry;
/*     */ import com.zimbra.cs.account.Group;
/*     */ import com.zimbra.cs.account.NamedEntry;
/*     */ import com.zimbra.cs.account.Zimlet;
/*     */ import com.zimbra.cs.account.accesscontrol.ACLUtil;
/*     */ import com.zimbra.cs.account.accesscontrol.AdminRight;
/*     */ import com.zimbra.cs.account.accesscontrol.AllowedAttrs;
/*     */ import com.zimbra.cs.account.accesscontrol.AllowedAttrs.Result;
/*     */ import com.zimbra.cs.account.accesscontrol.CheckAttrRight;
/*     */ import com.zimbra.cs.account.accesscontrol.GranteeType;
/*     */ import com.zimbra.cs.account.accesscontrol.Right;
/*     */ import com.zimbra.cs.account.accesscontrol.RightBearer.Grantee;
/*     */ import com.zimbra.cs.account.accesscontrol.RightCommand;
/*     */ import com.zimbra.cs.account.accesscontrol.TargetType;
/*     */ import com.zimbra.cs.account.accesscontrol.ZimbraACE;
/*     */ import com.zimbra.cs.account.ldap.LdapProv;
/*     */ import com.zimbra.qa.unittest.TestUtil;
/*     */ import com.zimbra.qa.unittest.prov.Verify;
/*     */ import com.zimbra.soap.admin.type.GranteeSelector.GranteeBy;
/*     */ import com.zimbra.soap.type.TargetBy;
/*     */ import java.io.PrintStream;
/*     */ import java.util.HashMap;
/*     */ import java.util.HashSet;
/*     */ import java.util.List;
/*     */ import java.util.Map;
/*     */ import java.util.Set;
/*     */ import org.junit.AfterClass;
/*     */ import org.junit.Assert;
/*     */ import org.junit.BeforeClass;
/*     */ import org.junit.Test;
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ public class TestACLAttrRight
/*     */   extends LdapTest
/*     */ {
/*     */   private static Right ATTR_RIGHT_GET_ALL;
/*     */   private static Right ATTR_RIGHT_GET_SOME;
/*     */   private static Right ATTR_RIGHT_SET_ALL;
/*     */   private static Right ATTR_RIGHT_SET_SOME;
/*     */   private static Map<String, Object> ATTRS_SOME;
/*     */   private static AllowedAttrs EXPECTED_SOME;
/*     */   private static AllowedAttrs EXPECTED_SOME_EMPTY;
/*     */   private static AllowedAttrs EXPECTED_ALL_MINUS_SOME;
/*     */   private static Map<String, Object> ATTRS_SOME_MORE;
/*  77 */   private static final ACLTestUtil.AllowOrDeny ALLOW = ACLTestUtil.AllowOrDeny.ALLOW;
/*  78 */   private static final ACLTestUtil.AllowOrDeny DENY = ACLTestUtil.AllowOrDeny.DENY;
/*  79 */   protected static final ACLTestUtil.GetOrSet GET = ACLTestUtil.GetOrSet.GET;
/*  80 */   protected static final ACLTestUtil.GetOrSet SET = ACLTestUtil.GetOrSet.SET;
/*     */   private static LdapProvTestUtil provUtil;
/*     */   private static LdapProv prov;
/*     */   private static Domain domain;
/*     */   private static String DOMAIN_NAME;
/*     */   private static Account globalAdmin;
/*     */   
/*     */   @BeforeClass
/*     */   public static void init()
/*     */     throws Exception
/*     */   {
/*  91 */     provUtil = new LdapProvTestUtil();
/*  92 */     prov = provUtil.getProv();
/*  93 */     domain = provUtil.createDomain(baseDomainName());
/*  94 */     DOMAIN_NAME = domain.getName();
/*  95 */     globalAdmin = provUtil.createGlobalAdmin("globaladmin", domain);
/*     */     
/*  97 */     Set<String> EMPTY_SET = new HashSet();
/*     */     
/*  99 */     ATTRS_SOME = new HashMap();
/* 100 */     ATTRS_SOME.put("zimbraMailQuota", "123");
/* 101 */     ATTRS_SOME.put("zimbraQuotaWarnPercent", "123");
/* 102 */     ATTRS_SOME.put("zimbraQuotaWarnInterval", "123");
/* 103 */     ATTRS_SOME.put("zimbraQuotaWarnMessage", "123");
/*     */     
/* 105 */     ATTRS_SOME_MORE = new HashMap(ATTRS_SOME);
/* 106 */     ATTRS_SOME_MORE.put("zimbraFeatureMailEnabled", "TRUE");
/* 107 */     ATTRS_SOME_MORE.put("zimbraFeatureCalendarEnabled", "TRUE");
/* 108 */     ATTRS_SOME_MORE.put("zimbraPrefLocale", "en-us");
/*     */     
/* 110 */     Set<String> ALL_ACCOUNT_ATTRS = null;
/* 111 */     ALL_ACCOUNT_ATTRS = AttributeManager.getInstance().getAllAttrsInClass(AttributeClass.account);
/*     */     
/* 113 */     ATTR_RIGHT_GET_ALL = ACLTestUtil.getRight("getAccount");
/* 114 */     ATTR_RIGHT_GET_SOME = ACLTestUtil.getRight("test-getAttrs-account-2");
/* 115 */     ATTR_RIGHT_SET_ALL = ACLTestUtil.getRight("modifyAccount");
/* 116 */     ATTR_RIGHT_SET_SOME = ACLTestUtil.getRight("test-setAttrs-account-2");
/*     */     
/* 118 */     Set<String> ALL_ACCOUNT_ATTRS_MINUS_SOME = SetUtil.subtract(ALL_ACCOUNT_ATTRS, ATTRS_SOME.keySet());
/*     */     
/* 120 */     EXPECTED_SOME = AllowedAttrs.ALLOW_SOME_ATTRS(ATTRS_SOME.keySet());
/* 121 */     EXPECTED_SOME_EMPTY = AllowedAttrs.ALLOW_SOME_ATTRS(EMPTY_SET);
/* 122 */     EXPECTED_ALL_MINUS_SOME = AllowedAttrs.ALLOW_SOME_ATTRS(ALL_ACCOUNT_ATTRS_MINUS_SOME);
/*     */   }
/*     */   
/*     */   @AfterClass
/*     */   public static void cleanup() throws Exception {
/* 127 */     Cleanup.deleteAll(new String[] { baseDomainName() });
/*     */   }
/*     */   
/*     */   private String getAddress(String localPart) {
/* 131 */     return TestUtil.getAddress(localPart, DOMAIN_NAME);
/*     */   }
/*     */   
/*     */   private String getAddress(String testCaseName, String localPartSuffix) {
/* 135 */     return getAddress(testCaseName + "-" + localPartSuffix);
/*     */   }
/*     */   
/*     */   private Account createAccount(String acctName) throws Exception {
/* 139 */     return provUtil.createAccount(acctName);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private List<ZimbraACE> grantRight(TargetType targetType, Entry target, Set<ZimbraACE> aces)
/*     */     throws ServiceException
/*     */   {
/* 164 */     for (ZimbraACE ace : aces) {
/* 165 */       Assert.assertTrue(ace.getRight().isUserRight());
/*     */     }
/*     */     Entry targetEntry;
/*     */     Entry targetEntry;
/* 169 */     if ((target instanceof Zimlet))
/*     */     {
/* 171 */       String targetName = ((Zimlet)target).getName();
/* 172 */       targetEntry = TargetType.lookupTarget(prov, targetType, TargetBy.name, targetName);
/*     */     } else {
/* 174 */       String targetId = (target instanceof NamedEntry) ? ((NamedEntry)target).getId() : null;
/* 175 */       targetEntry = TargetType.lookupTarget(prov, targetType, TargetBy.id, targetId);
/*     */     }
/* 177 */     return ACLUtil.grantRight(prov, targetEntry, aces);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   private void grantRight(Account authedAcct, TargetType targetType, NamedEntry target, GranteeType granteeType, NamedEntry grantee, Right right, ACLTestUtil.AllowOrDeny grant)
/*     */     throws ServiceException
/*     */   {
/* 188 */     RightCommand.grantRight(prov, authedAcct, targetType.getCode(), TargetBy.name, target == null ? null : target.getName(), granteeType.getCode(), GranteeSelector.GranteeBy.name, grantee.getName(), null, right.getName(), grant.toRightModifier());
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */   private void verify(Account grantee, Entry target, ACLTestUtil.GetOrSet getOrSet, AllowedAttrs expected)
/*     */     throws Exception
/*     */   {
/* 197 */     AllowedAttrs allowedAttrs = getOrSet.isGet() ? CheckAttrRight.accessibleAttrs(new RightBearer.Grantee(grantee), target, AdminRight.PR_GET_ATTRS, false) : CheckAttrRight.accessibleAttrs(new RightBearer.Grantee(grantee), target, AdminRight.PR_SET_ATTRS, false);
/*     */     
/*     */ 
/*     */ 
/* 201 */     verifyEquals(expected, allowedAttrs);
/*     */   }
/*     */   
/*     */   void verifyEquals(AllowedAttrs expected, AllowedAttrs actual) throws Exception {
/* 205 */     Assert.assertEquals(expected.getResult(), actual.getResult());
/* 206 */     if (actual.getResult() == AllowedAttrs.Result.ALLOW_SOME) {
/* 207 */       Verify.verifyEquals(expected.getAllowed(), actual.getAllowed());
/*     */     }
/*     */   }
/*     */   
/*     */   private void oneGrantSome(ACLTestUtil.AllowOrDeny grant, ACLTestUtil.GetOrSet getOrSet, AllowedAttrs expected)
/*     */     throws Exception
/*     */   {
/* 214 */     String testName = "oneGrantSome-" + grant.name() + "-" + getOrSet.name();
/*     */     
/* 216 */     System.out.println("Testing " + testName);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 221 */     Account authedAcct = globalAdmin;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 226 */     Account GA = provUtil.createDelegatedAdmin(getAddress(testName, "GA"));
/*     */     
/*     */     Right someRight;
/*     */     
/*     */     Right someRight;
/*     */     
/* 232 */     if (getOrSet.isGet()) {
/* 233 */       someRight = ATTR_RIGHT_GET_SOME;
/*     */     } else {
/* 235 */       someRight = ATTR_RIGHT_SET_SOME;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 241 */     Account TA = createAccount(getAddress(testName, "TA"));
/* 242 */     grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_USER, GA, someRight, grant);
/*     */     
/* 244 */     verify(GA, TA, getOrSet, expected);
/*     */   }
/*     */   
/*     */   public void oneGrantAll(ACLTestUtil.AllowOrDeny grant, ACLTestUtil.GetOrSet getOrSet, AllowedAttrs expected) throws Exception
/*     */   {
/* 249 */     String testName = "oneGrantAll-" + grant.name() + "-" + getOrSet.name();
/*     */     
/* 251 */     System.out.println("Testing " + testName);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 256 */     Account authedAcct = globalAdmin;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 261 */     Account GA = provUtil.createDelegatedAdmin(getAddress(testName, "GA"));
/*     */     
/*     */     Right allRight;
/*     */     
/*     */     Right allRight;
/*     */     
/* 267 */     if (getOrSet.isGet()) {
/* 268 */       allRight = ATTR_RIGHT_GET_ALL;
/*     */     } else {
/* 270 */       allRight = ATTR_RIGHT_SET_ALL;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 276 */     Account TA = createAccount(getAddress(testName, "TA"));
/* 277 */     grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_USER, GA, allRight, grant);
/*     */     
/* 279 */     verify(GA, TA, getOrSet, expected);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */   private void someAllSameLevel(ACLTestUtil.AllowOrDeny some, ACLTestUtil.AllowOrDeny all, ACLTestUtil.GetOrSet getOrSet, AllowedAttrs expected)
/*     */     throws Exception
/*     */   {
/* 287 */     String testName = "someAllSameLevel-" + some.name() + "-some-" + all.name() + "-all-" + getOrSet.name();
/*     */     
/*     */ 
/* 290 */     System.out.println("Testing " + testName);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 295 */     Account authedAcct = globalAdmin;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 300 */     Account GA = provUtil.createDelegatedAdmin(getAddress(testName, "GA"));
/*     */     
/*     */     Right allRight;
/*     */     
/*     */     Right someRight;
/*     */     
/*     */     Right allRight;
/* 307 */     if (getOrSet.isGet()) {
/* 308 */       Right someRight = ATTR_RIGHT_GET_SOME;
/* 309 */       allRight = ATTR_RIGHT_GET_ALL;
/*     */     } else {
/* 311 */       someRight = ATTR_RIGHT_SET_SOME;
/* 312 */       allRight = ATTR_RIGHT_SET_ALL;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 318 */     Account TA = createAccount(getAddress(testName, "TA"));
/* 319 */     grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_USER, GA, someRight, some);
/* 320 */     grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_USER, GA, allRight, all);
/*     */     
/* 322 */     verify(GA, TA, getOrSet, expected);
/*     */   }
/*     */   
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */ 
/*     */   public void someAllDiffLevel(ACLTestUtil.AllowOrDeny some, ACLTestUtil.AllowOrDeny all, boolean someIsCloser, ACLTestUtil.GetOrSet getOrSet, AllowedAttrs expected)
/*     */     throws Exception
/*     */   {
/* 335 */     String testName = "someAllDiffLevel-" + some.name() + "-some-" + all.name() + "-all-" + (someIsCloser ? "someIsCloser" : "allIsCloser") + "-" + getOrSet.name();
/*     */     
/*     */ 
/* 338 */     System.out.println("Testing " + testName);
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 343 */     Account authedAcct = globalAdmin;
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 348 */     Account GA = provUtil.createDelegatedAdmin(getAddress(testName, "GA"));
/* 349 */     Group GG = provUtil.createAdminGroup(getAddress(testName, "GG"));
/* 350 */     prov.addGroupMembers(GG, new String[] { GA.getName() });
/*     */     
/*     */     Right allRight;
/*     */     
/*     */     Right someRight;
/*     */     
/*     */     Right allRight;
/* 357 */     if (getOrSet.isGet()) {
/* 358 */       Right someRight = ATTR_RIGHT_GET_SOME;
/* 359 */       allRight = ATTR_RIGHT_GET_ALL;
/*     */     } else {
/* 361 */       someRight = ATTR_RIGHT_SET_SOME;
/* 362 */       allRight = ATTR_RIGHT_SET_ALL;
/*     */     }
/*     */     
/*     */ 
/*     */ 
/*     */ 
/* 368 */     Account TA = createAccount(getAddress(testName, "TA"));
/*     */     
/* 370 */     if (someIsCloser) {
/* 371 */       grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_USER, GA, someRight, some);
/* 372 */       grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_GROUP, GG, allRight, all);
/*     */     } else {
/* 374 */       grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_USER, GA, allRight, all);
/* 375 */       grantRight(authedAcct, TargetType.account, TA, GranteeType.GT_GROUP, GG, someRight, some);
/*     */     }
/*     */     
/*     */ 
/* 379 */     verify(GA, TA, getOrSet, expected);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testOneGrantSome() throws Exception {
/* 384 */     oneGrantSome(ALLOW, SET, EXPECTED_SOME);
/* 385 */     oneGrantSome(DENY, SET, EXPECTED_SOME_EMPTY);
/* 386 */     oneGrantSome(ALLOW, GET, EXPECTED_SOME);
/* 387 */     oneGrantSome(DENY, GET, EXPECTED_SOME_EMPTY);
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testOneGrantAll() throws Exception {
/* 392 */     oneGrantAll(ALLOW, SET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 393 */     oneGrantAll(DENY, SET, AllowedAttrs.DENY_ALL_ATTRS());
/* 394 */     oneGrantAll(ALLOW, GET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 395 */     oneGrantAll(DENY, GET, AllowedAttrs.DENY_ALL_ATTRS());
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testTwoGrantsSameLevel() throws Exception {
/* 400 */     someAllSameLevel(ALLOW, ALLOW, SET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 401 */     someAllSameLevel(DENY, ALLOW, SET, EXPECTED_ALL_MINUS_SOME);
/* 402 */     someAllSameLevel(ALLOW, DENY, SET, AllowedAttrs.DENY_ALL_ATTRS());
/* 403 */     someAllSameLevel(DENY, DENY, SET, AllowedAttrs.DENY_ALL_ATTRS());
/*     */     
/* 405 */     someAllSameLevel(ALLOW, ALLOW, GET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 406 */     someAllSameLevel(DENY, ALLOW, GET, EXPECTED_ALL_MINUS_SOME);
/* 407 */     someAllSameLevel(ALLOW, DENY, GET, AllowedAttrs.DENY_ALL_ATTRS());
/* 408 */     someAllSameLevel(DENY, DENY, GET, AllowedAttrs.DENY_ALL_ATTRS());
/*     */   }
/*     */   
/*     */   @Test
/*     */   public void testTwoGrantsDiffLevel() throws Exception
/*     */   {
/* 414 */     someAllDiffLevel(ALLOW, ALLOW, true, SET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 415 */     someAllDiffLevel(DENY, ALLOW, true, SET, EXPECTED_ALL_MINUS_SOME);
/* 416 */     someAllDiffLevel(ALLOW, DENY, true, SET, EXPECTED_SOME);
/* 417 */     someAllDiffLevel(DENY, DENY, true, SET, AllowedAttrs.DENY_ALL_ATTRS());
/*     */     
/* 419 */     someAllDiffLevel(ALLOW, ALLOW, false, SET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 420 */     someAllDiffLevel(DENY, ALLOW, false, SET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 421 */     someAllDiffLevel(ALLOW, DENY, false, SET, AllowedAttrs.DENY_ALL_ATTRS());
/* 422 */     someAllDiffLevel(DENY, DENY, false, SET, AllowedAttrs.DENY_ALL_ATTRS());
/*     */     
/* 424 */     someAllDiffLevel(ALLOW, ALLOW, true, GET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 425 */     someAllDiffLevel(DENY, ALLOW, true, GET, EXPECTED_ALL_MINUS_SOME);
/* 426 */     someAllDiffLevel(ALLOW, DENY, true, GET, EXPECTED_SOME);
/* 427 */     someAllDiffLevel(DENY, DENY, true, GET, AllowedAttrs.DENY_ALL_ATTRS());
/*     */     
/* 429 */     someAllDiffLevel(ALLOW, ALLOW, false, GET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 430 */     someAllDiffLevel(DENY, ALLOW, false, GET, AllowedAttrs.ALLOW_ALL_ATTRS());
/* 431 */     someAllDiffLevel(ALLOW, DENY, false, GET, AllowedAttrs.DENY_ALL_ATTRS());
/* 432 */     someAllDiffLevel(DENY, DENY, false, GET, AllowedAttrs.DENY_ALL_ATTRS());
/*     */   }
/*     */ }


/* Location:              /home/mint/zimbrastore.jar!/com/zimbra/qa/unittest/prov/ldap/TestACLAttrRight.class
 * Java compiler version: 7 (51.0)
 * JD-Core Version:       0.7.1
 */